Getting Data In

How to monitor Microsoft CA logs on Server 2008 R2?

jodros
Builder

Has anyone been successful in monitoring Microsoft CA logs on Server 2008 R2? It looks as if they are being written to C:\Windows\System32\CertLog in EDB log format, which is not human readable. I want to say the EDB log format might also be used by Microsoft Exchange, so I don't know if any TA or SA for exchange could be leveraged.

Any assistance with this issue would be appreciated.

Thanks

Tags (2)
0 Karma
1 Solution

jodros
Builder

Figured out the issue. There was an additional auditing setting that needed to be tweaked in the GPO before the CA events started showing up in the WinEventLog:Security. No need to try and figure out a way to monitor the edb files.

View solution in original post

0 Karma

jodros
Builder

Figured out the issue. There was an additional auditing setting that needed to be tweaked in the GPO before the CA events started showing up in the WinEventLog:Security. No need to try and figure out a way to monitor the edb files.

0 Karma

thambisetty
Super Champion

would be helpful, if you could provide how did you fix this.

————————————
If this helps, give a like below.

nabeel652
Builder

Do you remember what change did you make in GPO in order to collect CerLog like EventCode=64 etc?

jlemoine
Path Finder

What was the solution?

0 Karma

jodros
Builder

early morning bump. No one is monitoring any Microsoft CA servers running on 2008 R2 with Splunk?

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...